Remote code execution

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

Design/Logic Flaw

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAPAUTH header timestamp value. In HTTP requests, part of the HNAPAUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to...

CVE-2019-19597

The D-Link DAP-1860 WiFi range extender is vulnerable to arbitrary remote code execution as root without authentication. The root cause is the improper handling of shell metacharacters within the HNAP_AUTH HTTP header . Affected devices are those running firmware versions before v1.04b03 Beta . S...

CVE-2019-19597

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

CVE-2019-19598

CVE-2019-19598 affects D-Link DAP-1860 devices prior to v1.04b03 Beta. The vulnerability allows bypassing authentication to access administrator functions via the HNAP_AUTH header timestamp; if the timestamp matches the device’s /var/hnap/timestamp value, the HNAP_AUTH check passes. This is an ad...

CVE-2019-19598

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAPAUTH header timestamp value. In HTTP requests, part of the HNAPAUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to...

CVE-2019-19598: Improper Authentication

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAPAUTH header timestamp value. In HTTP requests, part of the HNAPAUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to...

PT-2019-15883

Name of the Vulnerable Software and Affected Versions D-Link DAP-1860 versions prior to v1.04b03 Beta Description The issue allows for arbitrary remote code execution as root without authentication. This is achieved via shell metacharacters within an HNAP AUTH HTTP header. Recommendations For...

CVE-2019-19597: Incorrect Authorization

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAPAUTH HTTP header...

D-Link DAP-1860 Authorization Issues Vulnerability

The D-Link DAP-1860 is a WiFi range extender from AUO D-Link of Taiwan, China. The D-Link DAP-1860 is vulnerable to an authorization issue. An attacker can exploit the vulnerability to gain unauthenticated access to administrator functions with the help of a timestamp value in the HNAPAUTH header...

D-Link DAP-1860 Remote Code Execution Vulnerability

The D-Link DAP-1860 is a WiFi range extender from AUO D-Link of Taiwan, China. A remote code execution vulnerability exists in the D-Link DAP-1860. The vulnerability can be exploited by an attacker to execute arbitrary code with root privileges with the help of shell metacharacters in the HNAPAUT...

PT-2019-15884

Name of the Vulnerable Software and Affected Versions D-Link DAP-1860 versions prior to v1.04b03 Beta Description The issue allows access to administrator functions without authentication by manipulating the HNAP AUTH header timestamp value in HTTP requests. This value is compared to the one stor...

D-Link DAP-1320 Wireless Range Extender CVE-2019-17505 Information Disclosure Vulnerability

Description D-Link DAP-1320 Wireless Range Extender is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information and perform unauthorized actions. D-Link DAP-1320 Rev A2 version 1.21 is vulnerable. Other versions may also be affected...

D-Link DAP-1320 Authorization Issues Vulnerability

The D-Link DAP-1320 is a wireless signal extender from AUO D-Link of Taiwan, China. A security vulnerability exists in the D-Link DAP-1320 A2-V1.21 version, which originates from some web interfaces that do not require authentication. An attacker could obtain the user's Wi-Fi SSID and password to...

Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

D-Link DAP-1320 A2-V1.21 Routers Information Disclosure Vulnerability

D-Link DAP-1320 routers are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-17505

D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplinkinfo.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack...

CVE-2019-17505

CVE-2019-17505 affects the D-Link DAP-1320 A2-V1.21 wireless range extender. The vulnerability arises from web interfaces that do not require authentication, enabling remote retrieval of the Wi‑Fi SSID and password (via uplink_info.xml). Impact is information disclosure of credentials, with CVSS ...

PT-2019-4071

Name of the Vulnerable Software and Affected Versions D-Link DAP-1320 A2 versions prior to V1.21 Description The issue is related to weaknesses in the authentication procedure of the web interface in D-Link DAP-1320 A2 wireless router firmware. This can allow a remote attacker to gain unauthorize...

CVE-2019-17505: Missing Authentication for Critical Function

D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplinkinfo.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack...